vmagent: set consul datacenter (fix 0 discovered targets) (#240)

## Why
The Consul SD job discovered **0 targets**. vmagent logs showed it reaching the puppet Consul fine (TLS/connectivity OK) but getting `403` on `GET /v1/agent/self`: the anonymous token `lacks permission 'agent:read'`. VictoriaMetrics calls `/v1/agent/self` only to auto-detect the datacenter; catalog/health reads (what SD actually needs) work anonymously.

## Fix
Set `datacenter: au-syd1` on the consul_sd_config so VM skips the `agent/self` call. No consul token needed.

## Verify after sync
vmagent `/targets` → `consul` job shows the puppet targets (haproxy/ceph/gitea/node/…) up.

Reviewed-on: #240
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/observability/vmagent.yaml

@@ -99,6 +99,10 @@ spec:
       consul_sd_configs:
         - server: consul.service.consul:443
           scheme: https
+          # Set datacenter explicitly so VM does not call /v1/agent/self
+          # (which needs agent:read that the anonymous token lacks); catalog
+          # and health reads work anonymously.
+          datacenter: au-syd1
           tls_config:
             ca_file: /etc/vmagent-tls/ca.crt
       relabel_configs: